sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: comprehensive README rewrite — all recent projects

Browse source 
- Add AgentForge multi-tenant AI agent workspace with dual-tier vLLM
- Add Multi-Profile AI Agent Team with automated audit-to-fix pipeline
- Add Gateway API / HTTPRoute routing architecture
- Add Waitlist API (FastAPI + asyncpg + idempotent signups)
- Add CNPG Database Fleet with isolated per-domain clusters
- Add Local Business Web Deployment Pipeline
- Update AI/ML table: Ollama/Gemma2 → vLLM/Qwen 3.6 27B Abliterated
- Update GPU pools: add A100 80GB SPOT deep thinker tier
- Update container images: siriussec/* → ghcr.io/sirius0xdev/*
- Expand architecture diagram with new namespaces and sec-ops
- Expand security section with automated auditing, NetworkPolicy, rate limiting
- Remove PineScript note and outdated ollama/siriussec references
- Add TOC entry for cost optimization
This commit is contained in:
Sirius Devops 2026-05-15 00:31:18 +00:00
parent ac994f144a
commit dbe562b6c2
1 changed files with 223 additions and 97 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

308
README.md
View file

@ -1,6 +1,6 @@
# GCloud-Lab DevOps Infrastructure # GCloud-Lab DevOps Infrastructure
A cloud-native DevOps laboratory project showcasing modern infrastructure-as-code, GitOps practices, and Kubernetes orchestration on Google Cloud Platform. This project runs a news intelligence system with LLM-powered analysis and a workflow automation platform. A production-grade cloud-native infrastructure laboratory demonstrating GitOps, multi-tenant AI agent hosting, and automated security pipelines — all run by a single DevOps engineer on Google Cloud Platform. Trusted by builders who ship.
## Table of Contents ## Table of Contents
@ -13,46 +13,75 @@ A cloud-native DevOps laboratory project showcasing modern infrastructure-as-cod
- [Applications](#applications) - [Applications](#applications)
- [Getting Started](#getting-started) - [Getting Started](#getting-started)
- [Security](#security) - [Security](#security)
- [Cost Optimization](#cost-optimization)
- [License](#license)
--- ---
## Project Overview ## Project Overview
This repository contains infrastructure and application configurations for: This repository is the single source of truth for a multi-application cloud platform running on GKE. Every deployment, database, and network policy flows through Git via Flux CD. What lives here:
1. **News Intelligence Pipeline**: Automated web scraping, LLM-powered summarization, and Telegram distribution 1. **AgentForge** — Private multi-tenant AI agent workspace with dual-tier vLLM inference (L4 dispatcher + A100 deep thinker) and isolated CNPG databases per tenant.
2. **Workflow Automation**: N8N platform for custom integrations 2. **Multi-Profile AI Agent Team** — Six specialist AI profiles (backend-dev, frontend-dev, researcher, outreach, quant, sec-ops) orchestrated through a shared Kanban board with automated audit-to-fix pipelines.
3. **DevOps Reference Architecture**: Demonstrates GitOps, IaC, and cloud-native best practices 3. **Waitlist API** — FastAPI landing page backend with idempotent signups, async PostgreSQL, and Telegram fire-and-forget notifications.
4. **Autonomous News Quant Pipeline** — 371 global feed scraper with DeepSeek-R1 analysis generating actionable futures trading signals.
5. **N8N Workflow Automation** — Self-hosted workflow engine with dedicated CNPG PostgreSQL.
6. **Local Business Web Deployment Pipeline** — Automated K8s manifest generation for small business websites with cross-namespace HTTPRoute routing.
--- ---
## Architecture ## Architecture
```text ```text
┌─────────────────────────────────────────────────────────────────────────┐ ┌──────────────────────────────────────────────────────────────────────────────┐
│ Google Cloud Platform │ │ Google Cloud Platform │
│ ┌───────────────────────────────────────────────────────────────────┐ │ │ ┌────────────────────────────────────────────────────────────────────────┐ │
│ │ GKE Cluster (devops-lab-cluster) │ │ │ │ GKE Cluster (devops-lab-cluster) │ │
│ │ │ │ │ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │
│ │ │ Standard │ │ L4 GPU Pool │ │ A100 GPU │ │ │ │ │ │ Standard │ │ L4 GPU Pool │ │ A100 GPU Pool│ │ │
│ │ │ Node Pool │ │ (SPOT L4) │ │ (SPOT A100) │ │ │ │ │ │ Node Pool │ │ (SPOT L4) │ │ (SPOT A100) │ │ │
│ │ │ e2-std-2 │ │ 1 node (24/7│ │ 0-1 nodes │ │ │ │ │ │ e2-std-2 │ │ 1 node (24/7)│ │ 0-1 nodes │ │ │
│ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ │
│ │ │ │ │ │ │ │
│ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ ┌──────────────────────────────────────────────────────────────────┐ │ │
│ │ │ Cilium CNI + Hubble │ │ │ │ │ │ Cilium CNI + Hubble + NetworkPolicy │ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ └──────────────────────────────────────────────────────────────────┘ │ │
│ │ │ │ │ │ │ │
│ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ ┌──────────────────────────────────────────────────────────────────┐ │ │
│ │ │ customer1 namespace │ │ │ │ │ │ Kubernetes Gateway API — external-http-gateway │ │ │
│ │ │ - OpenClaw PAaaS (Dual-Tier vLLM: L4 Dispatch / A100 Think)│ │ │ │ │ │ HTTPRoute PathPrefix → AgentForge / Waitlist / Apps │ │ │
│ │ │ - News Bot Pipeline (DeepSeek-R1 Quant Analyst) │ │ │ │ │ └──────────────────────────────────────────────────────────────────┘ │ │
│ │ │ - PAaaS Landing Page (GHCR Docker Pulls) │ │ │ │ │ │ │
│ │ │ - CloudNativePG Isolated Databases │ │ │ │ │ ┌───────────────────────────────┐ ┌───────────────────────────────┐ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ │ customer1 namespace │ │ agent-forge namespace │ │ │
│ └───────────────────────────────────────────────────────────────────┘ │ │ │ │ - AgentForge (PAaaS) │ │ - Tenant-specific OpenClaw │ │ │
└─────────────────────────────────────────────────────────────────────────┘ │ │ │ - Dual-tier vLLM │ │ - Isolated CNPG databases │ │ │
│ │ │ L4 Dispatcher (24/7) │ │ - Qwen 3.6 27B Abliterated │ │ │
│ │ │ A100 Deep Thinker (KEDA) │ │ - KEDA scale-to-zero │ │ │
│ │ │ - Waitlist API (FastAPI) │ │ │ │ │
│ │ │ - News Bot Pipeline │ │ ┌───────────────────────────┐ │ │ │
│ │ │ - Landing Page │ │ │ sec-ops audit agent │ │ │
│ │ │ - CNPG PostgreSQL Cluster │ │ │ Automated vuln scanning │ │ │
│ │ └───────────────────────────────┘ │ │ → backend-dev auto-fix │ │ │
│ │ │ └───────────────────────────┘ │ │ │
│ │ ┌───────────────────────────────┐ └───────────────────────────────┘ │ │
│ │ │ local-business namespaces │ │ │
│ │ │ - nginx + ConfigMap per biz │ ┌───────────────────────────────┐ │ │
│ │ │ - Cross-ns HTTPRoute refs │ │ monitoring namespace │ │ │
│ │ └───────────────────────────────┘ │ - Prometheus + Grafana │ │ │
│ │ │ - Tailscale-only access │ │ │
│ │ ┌───────────────────────────────┐ │ - No public ingress │ │ │
│ │ │ kanban namespace │ └───────────────────────────────┘ │ │
│ │ │ - Hermes Agent Orchestrator │ │ │
│ │ │ - 6 Specialist Profiles │ ┌───────────────────────────────┐ │ │
│ │ │ - Isolated hermes-pgdb │ │ n8n namespace │ │ │
│ │ └───────────────────────────────┘ │ - Workflow automation │ │ │
│ │ │ - Dedicated PostgreSQL │ │ │
│ │ └───────────────────────────────┘ │ │
│ └────────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────────┘
``` ```
--- ---
@ -92,15 +121,17 @@ This repository contains infrastructure and application configurations for:
| Tool | Version | Purpose | | Tool | Version | Purpose |
|------|---------|---------| |------|---------|---------|
| **CloudNative PG** | 0.26.1 | PostgreSQL Kubernetes operator | | **CloudNative PG** | 0.26.1 | PostgreSQL Kubernetes operator |
| **PostgreSQL** | 15.2 | Relational database (3-node HA cluster) | | **PostgreSQL** | 15.2 | Relational database (multi-cluster fleet) |
### AI/ML Infrastructure ### AI/ML Infrastructure
| Tool | Version | Purpose | | Tool | Version | Purpose |
|------|---------|---------| |------|---------|---------|
| **Ollama** | Latest | Local LLM inference server | | **vLLM** | v0.9.1 | High-throughput LLM inference server |
| **Gemma2** | Latest | Open-source LLM for text summarization | | **Qwen 3.6 27B Abliterated** | Latest | Uncensored reasoning model (A100 deep thinker tier) |
| **NVIDIA L4 GPU** | - | GPU acceleration for LLM workloads | | **Qwen 2.5 Coder 7B Abliterated** | Latest | Fast tool-calling dispatcher (L4 24/7 tier) |
| **NVIDIA L4 GPU** | - | 24/7 GPU for fast triage and dispatch |
| **NVIDIA A100 80GB** | - | SPOT GPU for deep reasoning and multi-file context |
### Development Environment ### Development Environment
@ -129,7 +160,7 @@ gcloud-lab/
│ ├── gke.tf # GKE cluster definition │ ├── gke.tf # GKE cluster definition
│ ├── vpc.tf # VPC and subnet configuration │ ├── vpc.tf # VPC and subnet configuration
│ ├── nodepool.tf # Standard node pool │ ├── nodepool.tf # Standard node pool
│ ├── nodepool-gpu.tf # GPU node pool (SPOT instances) │ ├── nodepool-gpu.tf # GPU node pools (L4 + A100 SPOT)
│ ├── flux.tf # Flux GitOps bootstrap │ ├── flux.tf # Flux GitOps bootstrap
│ ├── helm.tf # Helm chart deployments (Cilium) │ ├── helm.tf # Helm chart deployments (Cilium)
│ └── variables.tf # Input variables │ └── variables.tf # Input variables
@ -141,6 +172,7 @@ gcloud-lab/
│ │ ├── gotk-sync.yaml # Git repository sync │ │ ├── gotk-sync.yaml # Git repository sync
│ │ └── kustomization.yaml # Flux kustomization │ │ └── kustomization.yaml # Flux kustomization
│ ├── customer1.yaml # Customer1 Kustomization │ ├── customer1.yaml # Customer1 Kustomization
│ ├── agent-forge.yaml # AgentForge Kustomization
│ ├── infra-controllers.yaml # Infrastructure controllers (CNPG, KEDA, Monitoring, Tailscale) │ ├── infra-controllers.yaml # Infrastructure controllers (CNPG, KEDA, Monitoring, Tailscale)
│ └── infra-configs.yaml # Infrastructure configs │ └── infra-configs.yaml # Infrastructure configs
│ │
@ -159,25 +191,48 @@ gcloud-lab/
│ │
├── apps/ # Application deployments ├── apps/ # Application deployments
│ ├── base/ │ ├── base/
│ │ └── customer1/ │ │ ├── customer1/
│ │ ├── namespace.yaml # Namespace definition │ │ │ ├── namespace.yaml # Namespace definition
│ │ ├── deployment.yaml # N8N deployment │ │ │ ├── deployment.yaml # N8N + vLLM deployments
│ │ ├── service.yaml # ClusterIP service │ │ │ ├── service.yaml # ClusterIP services
│ │ ├── storage.yaml # PersistentVolumeClaim │ │ │ ├── storage.yaml # PersistentVolumeClaims
│ │ ├── configmap.yaml # N8N configuration │ │ │ ├── configmap.yaml # Application configuration
│ │ ├── pg-cluster-customer1.yaml # PostgreSQL cluster │ │ │ ├── pg-cluster-customer1.yaml # PostgreSQL cluster
│ │ ├── apigateway.yaml # GCP Gateway │ │ │ ├── apigateway.yaml # GCP Gateway
│ │ ├── http-route.yaml # HTTP routing │ │ │ ├── http-route.yaml # HTTP routing
│ │ ├── healthcheck.yaml # Health check policy │ │ │ ├── healthcheck.yaml # Health check policy
│ │ └── news_bot/ # News bot microservices │ │ │ ├── waitlist-api/ # Waitlist API microservice
│ │ ├── scraper-cronjob.yaml │ │ │ │ ├── deployment.yaml
│ │ ├── analyst-cronjob.yaml │ │ │ │ ├── service.yaml
│ │ ├── telebot-cronjob.yaml │ │ │ │ └── configmap.yaml
│ │ ├── scrapy-configmap.yaml │ │ │ └── news_bot/ # News bot microservices
│ │ └── scrapy-urls-configmap.yaml │ │ │ ├── scraper-cronjob.yaml
│ │ │ ├── analyst-cronjob.yaml
│ │ │ ├── telebot-cronjob.yaml
│ │ │ ├── scrapy-configmap.yaml
│ │ │ └── scrapy-urls-configmap.yaml
│ │ ├── agent-forge/
│ │ │ ├── namespace.yaml
│ │ │ ├── vllm-deep-thinker.yaml # A100 deployment with KEDA
│ │ │ ├── openclaw-tenant.yaml # Per-tenant OpenClaw instance
│ │ │ └── pg-cluster-agentforge.yaml
│ │ ├── kanban/
│ │ │ ├── namespace.yaml
│ │ │ ├── hermes-deployment.yaml # AI agent orchestrator
│ │ │ └── pg-cluster-hermes.yaml
│ │ └── local-business/
│ │ └── template/
│ │ ├── namespace.yaml
│ │ ├── nginx-deployment.yaml
│ │ ├── configmap.yaml
│ │ └── http-route.yaml
│ └── staging/ │ └── staging/
│ └── customer1/ │ ├── customer1/
│ └── kustomization.yaml # Staging overlay │ │ └── kustomization.yaml
│ ├── agent-forge/
│ │ └── kustomization.yaml
│ └── kanban/
│ └── kustomization.yaml
│ │
├── scripts/ ├── scripts/
│ └── setup # Development setup script │ └── setup # Development setup script
@ -202,8 +257,9 @@ gcloud-lab/
| Pool | Machine Type | Scaling | Purpose | | Pool | Machine Type | Scaling | Purpose |
|------|-------------|---------|---------| |------|-------------|---------|---------|
| Standard | e2-standard-2 | 1-16 nodes | General workloads | | Standard | e2-standard-2 | 1-16 nodes | General workloads, N8N, web servers |
| GPU (SPOT) | g2-standard-8 + L4 | 0-5 nodes | LLM inference | | GPU L4 (SPOT) | g2-standard-8 + L4 | 0-5 nodes | vLLM dispatcher, 24/7 fast inference |
| GPU A100 (SPOT) | a2-highgpu-1g + A100 80GB | 0-1 nodes | Deep thinker tier, multi-file reasoning |
### Networking ### Networking
@ -211,13 +267,25 @@ gcloud-lab/
- **Primary CIDR**: `10.0.0.0/16` - **Primary CIDR**: `10.0.0.0/16`
- **Pod CIDR**: `192.168.32.0/20` - **Pod CIDR**: `192.168.32.0/20`
- **Service CIDR**: `192.168.16.0/24` - **Service CIDR**: `192.168.16.0/24`
- **CNI**: Cilium with advanced datapath - **CNI**: Cilium with advanced datapath and NetworkPolicy enforcement
- **Ingress**: GCP L7 Global Load Balancer - **Ingress**: Kubernetes Gateway API via `external-http-gateway` with PathPrefix HTTPRoute routing
- **Internal Services**: Tailscale-only — no public ingress for monitoring, databases, or agent infrastructure
### CNPG Database Fleet
Multiple isolated PostgreSQL clusters, each with dedicated databases per application:
| Cluster | Namespace | Databases | Backup |
|---------|-----------|-----------|--------|
| `customer1-pgdb` | customer1 | `n8n`, `news_app`, `waitlist` | GCS, 7-day retention |
| `hermes-pgdb` | kanban | `hermes`, `memory_store` | GCS, 7-day retention |
| `openclaw-pgdb` | agent-forge | Per-tenant isolated DBs | GCS, 7-day retention |
| `siriusdevops-pgdb` | customer1 | `waitlist_prod` | GCS, 30-day retention |
### GitOps Flow ### GitOps Flow
``` ```
GitHub Repository GitHub Repository (ghcr.io/sirius0xdev)
│ │
▼ ▼
Flux Source Controller (watches git, 1min interval) Flux Source Controller (watches git, 1min interval)
@ -227,31 +295,76 @@ GitHub Repository
│ │
├── infrastructure/controllers → CNPG, KEDA, Monitoring, Tailscale ├── infrastructure/controllers → CNPG, KEDA, Monitoring, Tailscale
├── infrastructure/configs → Cluster configs ├── infrastructure/configs → Cluster configs
└── apps/staging/customer1 → Applications ├── apps/staging/customer1 → PAaaS, N8N, News Bot, Waitlist API
├── apps/staging/agent-forge → Multi-tenant AI agent hosting
├── apps/staging/kanban → AI Agent Team orchestrator
└── apps/staging/local-business → Business websites
``` ```
--- ---
## Applications ## Applications
### 1. Private Assistant as a Service (PAaaS) ### 1. AgentForge — Private AI Agent Workspace
A premium, uncensored, privacy-first AI assistant platform with dual-tier cognitive architecture:
- **Tier 1 (Dispatcher):** L4 GPU Spot instance running 24/7. Hosts `Qwen2.5-Coder-7B-Instruct-heretic` via vLLM `v0.9.1` for lightning-fast, cheap triage and tool calling (using the `pythonic` tool parser). A premium, uncensored, privacy-first AI agent hosting platform with dual-tier cognitive architecture:
- **Tier 2 (Deep Thinker):** A100 80GB Spot instance scaling from 0-1 via KEDA. Hosts `Qwen3.5-27B-heretic` with `--enable-chunked-prefill` and `--kv-cache-dtype=fp8` for massive multi-file context and reasoning without OOMing or stalling concurrent users.
- **Frontend:** Isolated `openclaw` deployments per tenant, connected to Telegram/Discord via outbound polling (no public ingress required). - **Tier 1 (Dispatcher):** L4 GPU SPOT instance running 24/7. Hosts `Qwen2.5-Coder-7B-Instruct-heretic` via vLLM `v0.9.1` for lightning-fast, cheap triage and tool calling.
- **Landing Page:** Dockerized marketing site built via CI/CD from `openclaw-projects` and deployed to the `staging` kustomization overlay. - **Tier 2 (Deep Thinker):** A100 80GB SPOT instance scaling from 0-1 via KEDA. Hosts `Qwen3.6-27B-heretic` with chunked prefill and FP8 KV cache for massive multi-file context and reasoning without OOMing.
- **Multi-Tenant Isolation:** Each tenant gets an isolated OpenClaw deployment with its own CNPG PostgreSQL database. No cross-tenant data leakage.
- **Landing Page:** Dockerized marketing site at siriusdevops.com, built via CI/CD from GitHub Actions and deployed to the staging kustomization overlay.
- **Container Registry:** All images pushed to `ghcr.io/sirius0xdev`.
### 2. Multi-Profile AI Agent Team
Six specialist AI agents orchestrated through a shared Kanban board, each with isolated memory, tools, and personality:
| Profile | Role | Key Capability |
|---------|------|---------------|
| **backend-dev** | Backend engineering | API design, database schema, K8s manifests |
| **frontend-dev** | Frontend engineering | UI/UX, landing pages, responsive design |
| **researcher** | Deep research | Market analysis, technical deep-dives |
| **outreach** | Communications | Content, social media, community building |
| **quant** | Quantitative analysis | Trading signals, market data pipelines |
| **sec-ops** | Security operations | Vulnerability scanning, audit pipelines |
**Automated Audit-to-Fix Pipeline:** The sec-ops agent continuously scans deployed infrastructure for vulnerabilities. When findings are confirmed, the backend-dev agent is automatically dispatched to remediate — from detection to patch in a single GitOps cycle.
### 3. Gateway API and HTTPRoute
Kubernetes Gateway API replaces legacy Ingress with a clean, declarative routing model:
- **Single Gateway:** `external-http-gateway` handles all external traffic.
- **PathPrefix Routing:** `/agentforge/*` → AgentForge landing, `/waitlist/*` → Waitlist API, `/business/*` → local business sites.
- **No Public Ingress for Internals:** Monitoring (Grafana/Prometheus), databases, and agent infrastructure are accessible only via Tailscale VPN.
- **Cross-Namespace References:** HTTPRoute resources in one namespace can reference Services in another, keeping routing centralized.
### 4. Waitlist API
FastAPI microservice powering the AgentForge waitlist at siriusdevops.com:
- **Database:** asyncpg connection pool to dedicated CNPG PostgreSQL.
- **Idempotent Signups:** `INSERT ... ON CONFLICT DO NOTHING` — duplicate emails are silently ignored, not rejected.
- **Notifications:** Fire-and-forget Telegram webhook on each new signup. No blocking I/O in the request path.
- **Security:** Rate limiting per IP, input sanitization, and CORS whitelist.
### 5. Autonomous News Quant Pipeline (`news_bot`)
### 2. Autonomous News Quant Pipeline (`news_bot`)
An institutional-grade pipeline scraping 371 global feeds to generate actionable futures trading signals: An institutional-grade pipeline scraping 371 global feeds to generate actionable futures trading signals:
- **Scraper:** CronJob at `:50` pulling multi-lingual global financial data. - **Scraper:** CronJob at `:50` pulling multi-lingual global financial data.
- **Map/Reduce Analyst:** Utilizes DeepSeek-R1 (with a strict 10-step `<think>` protocol) and local open-weights to extract "Market-Moving DNA". Translates events into explicit futures targets (/ES, /CL, /NQ) with R:R, Take Profit, and Stop Loss levels anchored in provided volume/price data. - **Map/Reduce Analyst:** DeepSeek-R1 with a strict 10-step think protocol extracts "Market-Moving DNA" and translates events into explicit futures targets (/ES, /CL, /NQ) with risk:reward, take profit, and stop loss levels.
- **Privacy:** All proprietary technical data stays strictly within the VPC, executing against local models rather than public APIs like OpenAI to protect the trading edge and avoid throttling during market panics. - **Privacy:** All proprietary technical data stays strictly within the VPC, executing against local models to protect the trading edge.
### 3. N8N Workflow Automation ### 6. Local Business Web Deployment Pipeline
- **Database**: PostgreSQL (dedicated `n8n` database)
- Custom integrations and webhook catchers.
*(Note: PineScript trading strategies have been migrated out of this IaC repository and live in `openclaw-projects/trading-bots`.)* Automated Kubernetes manifest generation for small business websites:
- **Stack:** nginx serving static content from ConfigMap, one namespace per business.
- **Routing:** HTTPRoute with cross-namespace Service references under `/business/<name>` paths.
- **Zero Cold Start:** Static sites have no database dependency — just nginx + ConfigMap, deployed via GitOps.
---
## Getting Started ## Getting Started
@ -342,16 +455,48 @@ or create a `monitoring-grafana-admin` Secret instead.
### Network Security ### Network Security
- Cilium network policies for pod-to-pod isolation - Cilium NetworkPolicy for pod-to-pod and namespace-to-namespace isolation
- TLS termination at load balancer - Kubernetes Gateway API with TLS termination at the load balancer
- Private cluster networking with NAT - Internal services (monitoring, databases, agent infrastructure) accessible only via Tailscale VPN — zero public ingress
- Rate limiting on public-facing APIs (Waitlist, landing page)
### Database Security ### Database Security
- Managed roles with secret-based passwords - Managed roles with secret-based passwords per application
- Separate users per application (`customer1`, `news_app`) - Separate PostgreSQL clusters per domain (hermes-pgdb, openclaw-pgdb, siriusdevops-pgdb)
- GCS backups with configurable retention policies
- HA cluster with automatic failover - HA cluster with automatic failover
### Automated Security Auditing
- **sec-ops Agent:** Continuously scans deployed infrastructure for CVEs, misconfigurations, and policy violations
- **Auto-Remediation:** Confirmed findings automatically dispatch the backend-dev agent to patch and commit
- **Audit Trail:** Every finding, fix, and deployment is tracked in Git history — full provenance from detection to resolution
---
## Cost Optimization
- **SPOT GPU Instances**: 60-90% savings on L4 and A100 workloads
- **KEDA Scale-to-Zero**: A100 deep thinker pool scales to 0 when no requests are queued
- **Resource Limits**: CPU and memory caps on every container prevent runaway costs
- **Scheduled Workloads**: CronJobs only run when needed — no idle inference pods
- **Tailscale for Internal Access**: No need for expensive internal load balancers or Cloud NAT for monitoring
---
## Container Images
```
ghcr.io/sirius0xdev/agentforge-landing:latest
ghcr.io/sirius0xdev/waitlist-api:latest
ghcr.io/sirius0xdev/newsscraper:latest
ghcr.io/sirius0xdev/summarizer:latest
ghcr.io/sirius0xdev/news-messenger:latest
docker.n8n.io/n8nio/n8n:2.1.4
ghcr.io/cloudnative-pg/postgresql:15.2
```
--- ---
## Tool Reference ## Tool Reference
@ -369,30 +514,11 @@ flux = "~> 1.7" # GitOps bootstrap
```yaml ```yaml
cilium: 1.18.5 # CNI and service mesh cilium: 1.18.5 # CNI and service mesh
cloudnative-pg: 0.26.1 # PostgreSQL operator cloudnative-pg: 0.26.1 # PostgreSQL operator
vllm: 0.9.1 # High-throughput LLM serving
``` ```
### Container Images
```
docker.n8n.io/n8nio/n8n:2.1.4
ghcr.io/cloudnative-pg/postgresql:15.2
ollama/ollama:latest
siriussec/newsscraper:latest
siriussec/summarizer:latest
siriussec/news-messenger:latest
```
---
## Cost Optimization
- **SPOT GPU Instances**: 60-90% savings on LLM workloads
- **Autoscaling**: GPU nodes scale to 0 when idle
- **Resource Limits**: Prevents runaway costs
- **Scheduled Workloads**: CronJobs only run when needed
--- ---
## License ## License
Private repository - All rights reserved. Private repository — All rights reserved.